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Abstract 



An n-bit string is encoded as a sequence of non-orthogonal quantum 
states. The parity bit of that n-bit string is described by one of two density 
matrices, and Pi , both in a Hilbert space of dimension 2 n . In order to 
derive the parity bit the receiver must distinguish between the two density 
matrices, e.g., in terms of optimal mutual information. In this paper we find 
the measurement which provides the optimal mutual information about the 
parity bit and calculate that information. We prove that this information 
decreases exponentially with the length of the string in the case where the 
single bit states are almost fully overlapping. We believe this result will 
be useful in proving the ultimate security of quantum crytography in the 
presence of noise. 
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I. INTRODUCTION 



A major question in quantum information theory JT]-[(| is "how well can two quantum 
states, or more generally, two density matrices po and pi, be distinguished?" In terms of 
a communication scheme this question is translated to an identification task: A sender 
(Alice) sends a bit b = % [i = 0; 1) to the receiver (Bob) by sending the quantum state p,, 
and the receiver does his best to identify the value of that bit, i.e. the quantum state. The 
Two-dimensional Hilbert space Ti.2 is usually used to implement such a binary channel, 
so the transmitted signals can be polarization states of photons, spin-states of spin-half 
particles etc. The transmitted states may be pure states or density matrices, and need not 
be orthogonal. Usually, the mutual information I is used to describe distinguishability, 
such that 1 = means indistinguishable, and 1 = 1 (for a binary channel) means perfect 
distinguishability. The ensemble of signals is agreed on in advance, and the main aim of 
Alice and Bob is to optimize the avarage mutual information over the different possible 
measurements at the receiving end. For a (simple) example, two orthogonal pure states 
transmitted through an error-free channel are perfectly distinguishable; The optimal mu- 
tual information (/ = 1) is obtained if Bob measures in an appropriate basis. Finding 
the optimal mutual information is still an open question for most ensembles. Some cases 
with known analytic solutions are the case of two pure states and the case of two density 
matrices in two dimensions with equal determinants |5j||. There are no known analytic 
solutions for two non-trivial density matrices in dimensions higher than two. In this paper 
we find a solvable case which has also practical implications. 

Let a single bit be presented by one of two quantum states, p and pi, in 7i 2 - These 
can be either pure states or density matrices with equal determinants. Suppose Bob 
wants to learn the parity bit (exclusive-OR) of an n-bit string of these bits and not the 
specific value of each bit. The parity bit is described by one of two density matrices 
Po™' ) and p^ which lie in a 2 n -dimensional Hilbert space H.%n . We solve the case of the 
distinguishablity of these parity density matrices when the two possible signals (of each 
single bit) are sent with equal probabilities. Let x be any classical string of n such bits, 
and p x = pQst bit) • • • P(n th bit) be the density matrix made up of the tensor product of the 
signaling states pn) corresposding to the i th bit of x. Formally, we distinguish between 
the two density matrices: 

Po ] = ^=1 E A» and Pi n) = E Px , (!) 

x\p(x)=0 " x\p(x)=l 

where the sum is over all possible strings with the same parity (each sent with equal 
probability (1/2™) and p(x) is the parity function of x. We show a simple way to write 
the parity density matrices and we calculate the optimal mutual information which can 
be obtained. 

Parity bits are often used in quantum cryptography [fTHToH, where they play a crucial 
role in error-correction and privacy amplification |IT|-ri"3|j . The question of security of 
quantum cryptography is yet open, and our results may have several implications for 
attacking this issue. In particular, the special case where the two signaling states have 
large overlap is important in the analysis of the security of quantum key distribution 
against powerful multi-particle eavesdropping attacks. 
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In Section |I| we find a simple way to write the density matrices of the parity bit 
for any n; We show that they can be put in a block diagonal form and we explain the 
importance of that fact. In Section [HI] we investigate the distinguishability of the parity 
matrices; The optimal measurement which distinguishes them is found to be a standard 
(von Neumann) measurement in an entangled basis (which is a generalization of the Bell 
basis of two particles); We calculate exactly the optimal mutual information which is 
derived on the parity bit by performing that optimal measurement. In Section |Iy| we 
show that for two almost fully overlapping states, the optimal mutual information Im 
decreases exponentially with the length of the string; This is the main result of our paper 
due to its possible importance to quantum cryptography. While exponentially small, this 
optimal information is nevertheless considerably greater than the information that would 
have been obtained by measuring each bit separately and classically combining the results 
of these measurements, thus, we prove the advantage of such "joint" measurements. Going 
back to the parity matrices obtained in Section || we are also able to calculate the maximal 
deterministic (conclusive) information; This is done in Section [V] where we also confirm a 
result previously obtained by Huttner and Peres [14]] for two bits. In Section [VI] we repeat 
the calculation of the optimal mutual information for the more general case where the bits 
are represented by non-pure states (in 7i 2 and with equal determinants). In Section |VII| 
we briefly discuss the implications of our results to the security of quantum cryptography. 



II. DENSITY MATRICES FOR PARITY BITS 

Let Alice send n bits. The possible values of a single bit (0 or 1) are represented by 

/ cos a\ ( cos a \ 

ipo = [ . and Vi = ■ 2 

\sm a J \— sin a J 

respectively. In terms of density matrices these are: 

# = - d tf>=(_^7), (3) 

where we use a shorter notation s = sin a; c = cos a, for convenience, and the superscript 
[jW is explained in the following paragraph. 

The parity bit of an n-bit string is the exclusive-OR of all the bits in the string. In 
other words, the parity is 1 if there are an odd number of l's and if there are an even 
number. The parity density matrices of n bits will be denoted as and pi in case 
the parity is '0' and '1' respectively. Using these density matrices we define also the total 



density matrix p^ = |(po +Pi™' ) ) an d the difference density matrix A( n ) = |(po^ ~ Pi\i 
so that 



pf) = p M + A< n > and p^ = - . (4) 

The one-particle density matrices (equation ^) also describe the parities of one particle, 
and therefore we can calculate 
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The density matrices of the parity bit of two particles are: 
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where the multiplication is a tensor product. The total density matrix is 



(p^+p! 2) ) 



which, by using the basis 
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in H4, can be written as 
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The difference density matrix is 
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The density matrices of the parity bit of n particles can be written recursively: 



(n) 

Po 



(pPp^+P?^] 



(n) 
Pi 



(l)„(n-l) (1) (n-lh 

' Pi Po 



leading to 



and 



+ n) = \{p { o n) +P i i ) )=P [l) P [n - l) 



AW = I( p W-p("))=A«A^- 1 ) 
2 

Using these expressions recursively we get 

p (n) = ( p (l))n 

which is diagonal, and 

A (n) = ( A (l))n 



(11) 



(12) 



(13) 



(14) 



(15) 



which has non-zero terms only in the secondary diagonal. The density matrices p n ^ and 
are now immediately derived for any n using equation (|]): 

pW = ( P (i))« + (A«r 



and 

pW = (p«)« _ (A«)V 
As an illustrative example we write p and pi for two particles: 
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(17) 



The only non-zero terms in the parity density matrices are the terms in the diagonals for 
any n, thus the parity density matrices have an X-shape in that basis. 

The basis vectors can be reorganized to yield block-diagonal matrices built of 2 x 2 
blocks. The original basis vectors (see, for example, equation||), are simply 2 n -vectors 
where the i th element of the i th basis vector is 1 and all other elements are (i ranges 
from to 2 n — 1). The new basis vectors are related to the old as follows: 



Wi) = IV 2 ) l° r even i an d \b[) = |&2™-(i+i)/2) for odd % 
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The parity density matrices are now, in the new basis (we omit the ' from now on as we 
will never write the matrices in the original basis): 



IBf^ ... \ 
Bf^ ... 

V o o ... BH= 2(n -^ J 



(19) 



where the subscript p stands for the parity (0 or 1). Each of the 2x2 matrices has the 
form 

( c 2(n-fe)g2fc _|_ c ri g n \ 
±c n s n c 2k s 2(n-k) I > (20) 

with the plus sign for p = and the minus sign for p = 1, and < k < n, and all these 
density matrices satisfy DetB^ = 0. The first block (j = 1) has k = 0; there are (fj 

blocks which have k = l or k = n — 1; there are ( 2 ) j' s which have k = 2 or k = n — 2, 
etc. This continues until k — (n — l)/2 for odd n. For even n the process continues up 
to k — n/2 with the minor adjustment that there are only |( n ™ 2 ) fs of k = n/2. This 
enumeration groups blocks which are identical or identical after interchange of k and n — k 
and accounts for all 2 ra /2 blocks. We will see later that blocks identical under interchange 
of k and n — k will contribute the same mutual information about the parity bit, thus we 
have grouped them together. 

With the density matrices written in such a block-diagonal form of 2x2 blocks the 
problem of finding the optimal mutual information can be analytically solved. It separates 
into two parts: 

• Determining in which of 2 n /2 orthogonal 2d subspaces (each corresponding to one 
of the 2x2 blocks) the system lies. 

• Performing the optimal measurement within that subspace. 

The subspaces may be thought of as 2 n /2 parallel channels, one of which is probabilistically 
chosen and used to encode the parity by means of a choice between two equiprobable pure 
states within that subspace (these two states are pure because the B and B 1 matrices each 
have zero determinant). We shall present in the next section the optimal measurement 
that yields the optimal mutual information transmissible through such a two-pure-state 
quantum channel. The channel then corresponds to a classical binary symmetric channel 
(BSC), i.e. a classical one-bit-in one-bit-out channel whose output differs from its input 
with some error probability pj independent of whether the input was or 1. The optimal 
mutual information in each subchannel is the optimal mutual information of a BSC with 
error probability pj and is hipj) = l — H(Pj), with H (x) = — x log 2 x— (1 — x) log 2 (l— x), 
the Shannon entropy function. The optimal mutual information Im for distinguishing 
from can thus be expressed as an average over the optimal mutual information of the 
subchannels: 

2 n /2 

= E <Hhlpj\ (21) 
i=i 
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where qj = Tr B$ = Tr Btf 1 is the probability of choosing the j'th subchannel. The BSC 
error probability pj for the j'th subchannel depends on the subchannel's 2x2 renormalized 
density matrices B^ = B^/qj, and is easily calculated once the optimal measurement is 
found. For each subchannel the qj and renormalized 2x2 matrices look like 



and 



g _ c 2(n-k) s 2k _|_ c 2k s 2(n-k) 



( c 2(n-k) s 2k ±c n S n 

c 2(n — fc) s 2fe_|_ c 2fe s 2(n-fc) c 2(n — k) g 2k _|_ c 2fc g 2(n — k) \ 
_j_ c n < ,n r ,2fc q 2(n — fc) 



V 



c 2(n~ k) g 2k _|_ c 2k s 2(n — k) J c 2(n — fc) s 2fc_|_ c 2fc s 2(n — fe) 

In our previous example of n = 2 the matrices are put in a block diagonal form: 
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III. OPTIMAL INFORMATION IN A PARITY BIT 

Two pure states or two density matrices in Ti,2 with equal determinants can always be 
written (in an appropriate basis) in the simple form 



* = * = l-i Z ) (26) 

with di real positive numbers such that Trp p = a\ + 03 = 1. For the two pure states 
of equation Q, say, for the polarization states of a photon, it is easy to see (and can be 
formally proven [§,0) that a standard measurement in an orthogonal basis symmetric to 
the two states optimizes the mutual information (and also minimizes the avarage error 
probability). The angle between one basis vector and the polarization state is f ±a. The 
measurement results in an error with probability 

P e = sin 2 C- -a)= 1 " COS( ^ ~ 2a) = 1 ~ Sin(2Q) , (27) 

and with the same error probability for both inputs, thus, leading to a binary symmetric 
channel (BSC). The optimal information of such a channel is well known and is 

I BSC = h{P e ) . (28) 
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Note that the overlap of the two-states is cos(2o;), thus, for two pure states in any dimen- 
sion, the optimal information I 2 ( — gMfel ) is a simple function of the overlap. The density 
matrices of such pure states (equation |D can be written as pi = (11 + a • rj)/2 with the 
a being the Pauli matrices and r = (± sin 2a, 0, cos 2a) being a three dimensional vector 
which describes a spin direction. Using this notation any density matrix is described by a 
point in a three dimensional unit ball, called the Bloch sphere. The pure states are points 
on the surface of that sphere (also called the Poincare sphere). With the density matrix 
notation the optimal basis for distinguishing the states is the x basis (note that the angle 
between the basis vector and the state is doubled in this notation). The measurement of 
the two projectors 



A. 




and 




(29) 



yields 



Tr piA_ 



do 

2 



(30) 



which recovers the result of equation (p7|) in case of pure states of equation (|J). However, 
the treatment of density matrices is more general and this is the optimal measurement 
also in the case of non-pure states with equal determinants |5]|| , when pi of equation (|3|) 
are replaced by pf m of equation fl69f) and ( [70]) of section [VI], and this case is also described 
by a BSC. The only difference between the matrices is that Det p p = for pure states and 
< Det p p < I for density matrices. 

Instead of measuring the density matrices in the x direction we perform the following 
unitary transformation on the density matrices 



U 



1 1 
1 -1 



(31) 



to obtain p' = U pW which is then measured in the z basis. Note that the transformation 
transform the original z-basis to x-basis (the motivation for this approach will be ubder- 
stood when we discuss the 2x2 blocks of the parity matrices). The new density matrices 
are 



, _ ( \ + a 2 ^ 

PO — ai-a 3 1 _ 
V ~^2~ 2 ~ fl 2 



f= (\-a 2 ^f* 

Pi I Oi^aa I + fl2 



(32) 



and their measurement yields the probability ~ ± a 2 to derive the correct (plus) and the 
wrong (minus) answers (as we obtained before), leading to optimal mutual information of 



(33) 



which depends only on a 2 . Note that the same information is obtained in case a\ and 03 
are interchanged. 
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The naive way to derive information on a parity bit is to derive the optimal information 
on each particle separately and calculate the information on the parity bit. We call this 
individual or single-particle measurement. It is the best Bob can do in case he has no 
quantum memory in which to keep the particles (which, usually arrive one at a time) 
or he has no ability to perform more advanced joint measurements. The optimal error- 
probability for each particle is r = = 1 ~ s " l2a , The probability of deriving the wrong 
parity bit is equal to the probability of having an odd number of errors on the individual 
particles 

P^= t ( n )r j (l-r) n - j ■ 



j =odd 



J, 



To perform the sum over only odd j we use the formulas 



n 



(p + q) n = E( n )p n "V and (p - q) n = £ 

j=0 \J ) j=Q \J 




to derive 



£ (jVy = (p + «)--(p-«r . (34) 



./=< 

Assigning q = r and p = 1 — r we get 




jl y 1 2 2 2 y 1 



The mutual information Is in this single-particle measurement is 

, (I (sin 2a)" \ . , 

Is = / 2 (P e W) = h f 5 - -^^) ( 36 ) 

l-sin(2a) 

using r = ^ — '-. 

A lot of useless side-information is also obtained (e.g., on the individual bits). This 
fact indicates that Bob might be able to do much better by concentrating on deriving 
only useful information. The optimal measurement for finding mutual information on 
the parity bit is not a single-particle measurement, but is instead a measurement on the 
full 2 n -dimensional Hilbert space of the system. In general, optimizing over all possible 
measurement is a very difficult task unless the two density matrices in Ti,2« are pure states. 
However, in the preceding section we have shown how to reduce the problem to that of 
distinguishing the 2x2 blocks of our block-diagnoral parity matricies. We now have only 
to apply the optimal single-particle measurement to the 2x2 5^'s of equation ^3] and use 
the result in equation |2l| . 

The error probability (equation [!(]) for distinguising the B^s is seen to be: 

1 c n s n 

q2{ti— k) g2k _|_ Q2kg2(n—k) ' 

(37) 
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from which the information hiPj) in each channel is obtained. 

Plugging the error probability pj (equation [37|) and the probability of choosing the 
j'th subchannel qj (equation |22|) into the optimal information on the parity bit is now: 



2 n /2 

f M = 



2 ™/ 2 /i r n n s. 

V- / 2(n-k) 2k , 2k 2(n-k)\ r f ^ \ /oo\ 

2-j^ C S +C S j J 2 ^ c 2(„_fc) s 2fc + c 2k s 2(n-k)J ' 

In the simple case of orthogonal states (a = |) all these density matrices are the same 

/ -, \ 71—1 

and we get ?j = (i) > Pj — and /a/ = 1 as expected. 

• A brief remark is in order at this stage. The transformation to the x basis for each 
2 by 2 matrix, B^ ,k ' is actually a transformation from a product basis to a fully 
entangled basis of the n particles. That basis is a generalization of the Bell basis of 



(39) 





n— 1 V / n \ / 1 \ / 2 V / n— 1 






n— 1 \ / n \ / 1 \ / 2 \ / n-1 




(40) 



etc. The Bell basis for two particles is frequently used and its basis contains the 
EPR singlet state and other three orthogonal fully entangled states. 

For large n, the number of blocks is exponentially large and performing the summation 
required in equation ^ is impractical, since all the 2 n_1 matrices must be taken into 
account. However, that problem can be simpmed by realizing that all blocks with a given 
k, as well as all blocks with k and n — k interchanged, contribute the same information 
to the total. This is easily seen in equation [38] where both the weight and the argument 
of I2 are symmetric in k and n — k. The optimal mutual information for even n is then 

I e M n = E {%kUPk) + ~ f U n Wa(p 9 ) , (41) 



and for odd n 



9 \ — 

Z \2/ 



I°m = Y, Hlkhipk) ■ (42) 




As an example we calculate Im for n = 2 (of course, the counting argument is not 



needed in that case). This particular result complements the result in |Tjj where the 
deterministic information of such a system is considered (see also Section 0). In the new 
basis (^) the density matrices of (equation ^5]) become 

£>=2,fc=0) _ / 1/^ + ^4 1 . A'(n=2,fe=0) _ 

V 2c 4 +s 4 A / Z c 4 +s 4 / \ 2c 4 + 
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and 

? '(n=2,fe=l) _ / 1 U \ ~'( n =2,fc=l) 




Br"^' = n n I Br^ =L) = „ i • (43) 




We use the notation S 1 = 2sc = sin 2a; C — c — s — cos 2a (hence, c — s = C and 
c 4 + s 4 = Hp-) to obtain q\ = 2c 2 s 2 = §, Pi = 0, q = |(1 + C 2 ) and p = 1^72 (the qjS 
were obtained in the previous section). The mutual information of the parity of two bits 
is obtained using equation ( |2l|) 

hi = qohipo) + qihipi) 



IV. INFORMATION ON THE PARITY BIT OF ALMOST FULLY 

OVERLAPPING STATES 

The case of almost fully overlapping states is extremely important to the analysis of 
eavesdropping attacks on any quantum key distribution scheme as will be discussed in 
Section |V1J| . In this case the angle a is small so s = sin a ~ a and c = cos ~ 1 — 
To observe the advantage of the joint measurement, let us first calculate the optimal 
information obtained by individual measurements. In that case, equations ( P5] and (fZ7j) 
yield 

p., = 1 _ . (45) 

For small 77 the logarithmic function is approximated by 

log(- ± V ) = ln 9 ±7?) « -1 ± ^-V ~ —V 2 , (46) 
&v 2 /; In 2 ln2 7 In 2 ' ' K J 

from which the mutual information 

h(\ - i?) = 1 - H (- - 1,) = 1 + (- + tj) log(- +»)) + (-- r,) log(i - i)) 

« j^l" (47) 

is obtained. Using this result and assigning 77 = (2a)"/2, the information (to first order) 
obtained by the optimal single-particle measurement is 

T _ 2 (2a) 2 " _ (2a) 2 " 



ln2 4 21n2 

We use the same approximations and equations flT7| ) and ( |2"2"D to calculate the leading 



terms in the optimal mutual information f|T] and ^2|. For k = ~ (n even) we get pu = 
(regardless of the small angle) and 
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J 2 (p») = 1 . (49) 



For fc < | we get pk ~ \ — 4^ ~ | — « n 2fc which yields (using equation 47 with r/ = a 



2 s 2k 2 

2 



„n-2fc\ 



^(P») « j^« 2n " 4fc • (50) 



The coefficient g fc = a 2A: for fe < § and g fc = 2a 2A: for fc = f , so that 



for k < | , and 



g fc / 2 (p fc ) « ^« 2(n " fc) ( 51 ) 



? fe / 2 (p fc ) « 2« n (52) 



for k = |. The dominant terms are those with the largest fc, that is, k closest to |. The 
next terms are smaller by two orders in a. The number of density matrices with these k's 
are also the largest (up to a factor of 2 in case of even n). Therefore, the terms k = ~ for 



even n and k = for odd n are the dominant terms in the final expression. Thus, for 



n-l 
2 

almost fully overlapping states, the mutual information is 
for even n, and 

rodd ^ ( 71 \ ^ n+ i 



IT * \ n-l)^ n+1 (53) 



2 



for odd n. 

These expressions can be further simplified. The number of density matrices of any 
type is bounded (for large n) using Stirling formula (see [TBI] in the chapter on Reed- 
Solomon codes) 

W ^2n(k/n)(l-k/n)n 

For k near | , 77 = | — - is small, and the standard approximation fl47|) : if ~ 1 - 
0(r/ 2 ) = 1 - O ((§ - A;/n) 2 ) < 1 

k/n(l — fc/n) ~ | — f? 2 , we derive 



0(rf) = 1 - O ((| - A;/n) 2 ) < 1 is used to derive (™) < . 2 " Using also 



Thus the leading term in Jm is 



„\ on 

< (l + 0(r/ 2 )) . (55) 



~n 
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(56) 



for even n and 



for odd n (using a < In 2/2). We see that we could keep a better bound for odd n but for 
simplicity we consider the same bound for both even and odd n's. 

We can now compare the optimal information Im from a joint measurement on all n 



particles to the optimal information Is from separate measurements (cf. eq. ^8 

I M = 0(1) x {2a) n /y/E 



Is = 0(1) x (2a) 



2» (5£ 



Since a is a small number (corresponding to highly overlapping signal states), the joint 
measurement is superior tothe individual measurement by a factor of 0( (2a) n ). However, 
it is only superior by a polynomial factor, since 



Im « (Is) 2 ■ (59) 



V. DETERMINISTIC INFORMATION ON THE PARITY BIT 

For a single particle Bob can perform a different kind of individual measurement which 
is not optimal in terms of avarage mutual information but is sometimes very useful 
It yields either a conclusive result about the value of that bit or an inconclusive one, and 
Bob will know which of the types of information he has succeeded in obtaining. Such a 
measurement corresponds to a binary erasure channel fi,I3],I7|. With probability p? of 
an inconclusive result, the mutual information is I p? = 1 — p?. The minimal probability 
for an inconclusive result is cos 2a leading to I p ., = 1 — cos 2a Q . This result is obtained 
by performing a generalized measurement (Positive Operator Value Measure P,|3|)|18|) on 
the system or a standard measurement performed on a larger system which contains the 
system and an auxilary particle pil9[]. Note that this results in less mutual information 



than the optimal measurement for one-particle mutual information. If Bob uses this type 
of measurement on each particle separately his deterministic single-particle information 
about the parity bit is (1 — cos2ct) n . 

We now use the block- diagonal density matrices derived in section [TJ to derive also 
the optimal deterministic information on the parity bit. We note that each of the 2x2 
blocks in the block- diagonal density matrices is the density matrix of a pure state, so we 
may replace the optimal measurement in each subchannel with the optimal deterministic 
measurement and proceed as before. The total optimal deterministic information is easily 
calculated by replacing ^(pk) in HU an d £|2] by I(p? k ) — 1 — p? k - To find the minimal P- 
we write each of the normalized density matrices B^ l,kS> as pure states with some angle 7: 



k 
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COS7 ^ and C ° S7 . (60) 



\su17y \-sm7 / 
Comparing with equation (p3|) 



hence 



c 2(n-fc) g 2k _ c 2k s 2(n-k) 

Pi = cos(2 7 ) = cos 2 7 - sin 2 7 = c2(n _ fc)g2fc - c2kg2(n _ k) , (61) 



c 2(n-k) g 2k _ c 2k s 2(n-k) 



1 c 2(n-fc) s 2fc _|_ c 2k s 2(n-k) ' ^2) 



The total information is 



j r n = E + ^)^ J (^/ 2 ) > (63) 



for even n, and 



n-l 
2 



^ d =EQ»%) (64) 
for odd n. 

For n = 2 we recover a result previously obtained by Huttner and Peres [|14| by 
performing the optimal POVM on the first pair of density matrices of equation (^), and 
a measurement in the entangled basis (as before) on the second. The probability of an 
inconclusive result is cos 2 7 — sin 2 7 = ^ 4 ~* 4 = , hence the optimal deterministic 
information is 1 — , leading to the total deterministic information 

Id = qiUp?) + g 2 / 2 (p 2 ) = \(1 + C 2 )(l - 2y-^) + y = 1 - C , (65) 

which is exactly the result obtained by Huttner and Peres (note, however, that they used 
an angle which is | — a hence derived 1 — S for the deterministic information). 

For almost overlapping states (small a) the dominant terms are still the same as in 
the case of optimal information. The term q k is as before and the information in each 
port is 

J(P?J = 1 (66) 



for k = ~ and 



„2n— 4fc „2n— 4k 

' - „2n-4fc\2 q 2n-4fc 



*M = 1 - C 2n-4k + S 2n-,k = 1 " (* " = 2ot^ (67) 

for k < | . Taking into consideration only the dominant term we get 

jeven [ n \ n ,n 

for even n which is the same as the optimal information, and 

i°D d « (4i) 2an+i ( 68 ) 

for odd n which is smaller than the optimal mutual information by a factor of r^. 
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VI. PARITY BIT FOR DENSITY MATRICES 



The previous disussion assumed that pjp are pure states. The generalization to the 
case of density matrices with equal determinants is straightforward. Let the bit '0' and 
the bit '1' be represented by 

?f =( sc -/7 r )> < 69 > 

and 

rf*-(-(«-P)" ( *" r) )- <™> 

(with s = sin a etc., and r < sc) which contains the most general density matrices of the 
desired type. On the Poincare sphere these density matrices have the same z components 
as the previously written pure states but smaller x components (hence smaller angle a'). 
We could choose other ways of representing these density matrices, e.g., with similar x 
components and smaller z components. Such representations were more appropriate for 
comparison with pure states (since they yield the same mutual information for a single 
particle) but less convenient for showing that the previous result is easily generalized. 
Clearly 

P ,i »- = i(rf , +pf») = (; 2 °), (7i) 



A<^ = i(„« -„?>)=( JC °_ r V)> < 72 > 

The total density matrix doesn't change and the difference density matrix has terms 
(sc — r) n instead of (sc) n . Reorganizing the basis vectors we again get the block diagonal 
matrices where each of the 2 by 2 matrices has the form 

R («,*)_ ( c 2 ^~ k h 2k ±(cs-r) n \ 

*v ' - [±( cs -r) n c 2k s 2 ^ )■ [<6) 

When normalized, these density matrices have the form of equation ^ and are optimaly 
distinguished by measuring them in the x direction. Transforming to the x basis as before 
we get the same 

q k = c Hn-k) s 2k + c 2k s 2(n-k) (74) 

as before, and 



Vh = I ( cs ~ r )" (75 ) 

^ k 2 c 2{n-k) s 2k c 2k s 2(n-k) ' V ,U J 
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The total information can now be calculated as before by assigning these pk and into 
equations (42 and |41]). Thus, the case of mixed states is also analytically solved for any 



number of bits, and the influence of mixing on the optimal mutual information is through 
the pkS. 

The case of a = \ (when the matricies commute) is of special interest^ due to its 
imporance to quantum bit committment [|TUJ. Equation ( ]73| ) yields 

Up -^ ±( l_ r) n ( l)n ) (7bj 

indepent of k. Normalizing and transforming to the entangled basis we get p = ~ — ^(1 — 
2r) n and q = (|) n_1 . There are 2 n ~ l matrices like that so 

hi = 2 n - 1 ( 1 -) n - 1 h (1 - ~(1 - 2r)») = I 2 (i - \{l - 2r)») . (77) 

However, in this case each particle actually carries a classical information hence the col- 
lective measurement cannot improve the derived information. Indeed, the one-particle 
density matrices yields probability r of deriving an error, leading to total error probabil- 
ity of equation (gD, = \- ^j^, and total information I s = h (| - |(1 - 2r) n ) 
as expected. Note that the mixing by itself induces an exponential decay of the amount 
of information, a fact used in [[H] 



Calculating the optimal information for small a and any r is possible but complicated. 
Another alternative which is much simpler is to find a bound on the optimal information 
using pure states with the same angle, a', on the Poincare sphere, using 

, sin 2a — 2r , 

tan 2a' = , 78 

cos 2a 

or using an alternative form for the mixed states ^ and |7D|. 

VII. IMPLICATIONS 



Protocols in quantum cryptography use parity bits. Quantum bit commitment [|1C 



quantum oblivious transfer [^jj and quantum key distribution JTTJ protocols use parities of 
publicly announced subsets of the transmitted bits for both error-correction and privacy 
amplification (PA). When used for error-correction, subset parities are publicly announced 
in order to identify errors and correct them, and this is a crucial step in real channels since 
it could leak information to Eve. When used for PA [|T^,|T^] (say, to derive one final bit) 
a subset parity is agreed to be the final secret bit, and this technique is used to limit the 
adversary's information to an exponentially small fraction of a bit. PA is effective when 



particles are not measured together (see discussions in [TJfl and in p2|), and presumably 



1 This case, including the X-shape of the parity matrices, was solved independently by D. Mayers 
I2C 
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also if all measurements are completed before the specification of the subsets used in PA 
is publicly announced. But it is still an open question whether it is effective also when the 
adversary can use this specification to choose her attack. Our result provides the optimal 
measurement which can be done to find a parity bit and therefore is crucial for such 
analysis. In particular cases, when almost fully overlapping states are used, we proved 
two complementary results regarding that optimal measurement: 

• The optimal information is much larger than the one obtained be measuring each 
bit separately. 

• The optimal measurement still yields exponentially small information. Thus we 
proved an effectiveness result classical PA techniques are effective against any quan- 
tum measurement. 

The discussion so far treats an imaginary scenario which is very general but is not good 
as a cryptographic protocol. 

Realistic protocols are very complicated (e.g., due to the use of error correction), hence, 
are more difficult to analyze. However, to emphasize the importance of the "effectiveness 
result" just mentioned let us consider a different scenario which is common in quantum 
key distribution schemes: Alice and Bob are the legitimate users who try to establish 
a secret key. They use any binary scheme and Alice sends n particles through a noisy 
channel to Bob. An adversary, Eve, is trying to learn information on their key. She gets 
the particles one at a time, interacts with each one of them weakly, and send it forward 
to Bob. She must interact weakly with all particles if she wants to induce only small 
error rate (or else she could attack strongly only few of the particles but PA is already 
proven effective against that type of attacks). The classical PA is also effective if Eve 
cannot use its specification to attack all bits together, but in reality she can do it if she 
has a quantum memory. Although the specification is announced after the transmission 
is over, Eve can keep information in the quantum state of a system which has interacted 
with all the transmitted particles, and use it after all the specification is announced. Such 
attack has never been analyzed in the case of real (noisy) channels and devices.^ The 
"effectiveness result" might allow one to prove security against a "collective" attack (first 
described by E. Biham and T. Mor) in which Eve learns the PA specification and the 
error-correction data and uses them to choose the optimal measurement. In that atack 
Eve attaches a separate probe to each particle via transluscent attack (defined in ||17||), 



using a quantum memory to keep the probes for a later time, and measuring them together 
after receiving all relevant data. Eve must attack weakly since she doesn't want to induce 
large error rate, so she obtains (for each transmitted particle) a probe with two almost 
overlapping pure states (or density matrices). Hence, the "effectiveness result" can be 
used to prove that her information on the final string is exponentially small in the length 
of the initial string. 



2 The case of error-free channels is completely solved, a consequence of [23,p4|. The case of 
error-free devices (but real channels) can be solved due to the possibility of purifying singlets 



mm. 
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